From 42b42f7aa180b0ee7698c210e0db55af479e0457 Mon Sep 17 00:00:00 2001
From: Randy Goodman <1679433+RGood@users.noreply.github.com>
Date: Wed, 11 Nov 2026 15:27:53 -0500
Subject: [PATCH] ci: declare job permissions and pin actions to full SHAs
 (M04, M06)

---
 .github/dependabot.yml    | 4 ++++
 .github/workflows/ci.yaml | 9 +++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1f90354..31aabe9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -29,3 +29,7 @@ updates:
         patterns:
           - "vite"
           - "@vitejs/*"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3ee9d3d..70fac4c 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -7,14 +7,19 @@ on:
   pull_request:
     branches: ['main']
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Install Node.js
-        uses: actions/setup-node@v6.4.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24.18.0
       - name: Install Dependencies